SC-200 - Practice test

You have a Microsoft 365 E5 subscription. You plan to deploy Microsoft Defender for Endpoint to meet the following requirements: · Block executable content from email messages. · Block unsigned processes that run from USB drives. Which Defender for Endpoint capability should you use?. Attack surface reduction. Block at first site. Controlled folder access. Exploit protection.

You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint. You need to be notified when new or updated threat analytics information is added to Microsoft Defender XDR. Which method can you use?. Configure a Microsoft Sentinel automation rule. Configure a threat analytics email notification rule. Configure a vulnerabilities email notification rule. Configure en Advanced Hunting detection rule. Configure an alert email notification rule.

You have a Microsoft Defender XDR subscription that uses automated remediation. You have a line-of-business (LOB) application named LOB1. LOB1 uses a file that was incorrectly blocked by Microsoft Defender XDR. You need to ensure that the file is unblocked immediately and prevent Microsoft Defender XDR from blocking the file again in the future. The solution must prevent other malicious files from being unblocked automatically. What should you do in the Microsoft Defender portal?. Configure a file threat indicator. Create a critical asset classification. Create a custom quarantine policy. Edit the Tenant Allow/Block List.

You have a hybrid environment that includes an on-premises Active Directory Domain Services (AD DS) domain, a Microsoft Entra tenant, and a Microsoft 365 E5 subscription. All Windows 11 devices are onboarded to Microsoft Defender for Endpoint. You deploy Microsoft Defender for Identity sensors to domain controllers. You need to enable automatic attack disruption in Microsoft Defender XDR. The solution must meet the following requirements: · During an active attack, affected devices must be contained automatically, and compromised user accounts must be disabled. · User disruptions must be minimized. What should you configure?. Advanced features in Microsoft Defender for Identity. Attack Surface Reduction (ASR) rules in Microsoft Defender for Endpoint. Device isolation in Microsoft Defender for Endpoint. Indicators in Microsoft Defender for Endpoint.

You have a Microsoft 365 E5 subscription that contains the following users: User1: · Microsoft Entra role: Global Administrator · Microsoft 365 role group: Security Administrator User2: · Microsoft Entra role: Security Administrator · Microsoft 365 role group: Security Reader User3: · Microsoft Entra role: Security Reader · Microsoft 365 role group: Security Reader Which users can modify the security settings in Microsoft Defender XDR?. User1 only. User1 and User2 only. User1 and User3 only. User1, User2 and User3.

You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint. You deploy an app named App1. App1 clears logs from an application server. When App1 runs, it triggers a Microsoft Defender alert. You need to prevent App1 from triggering alerts. The solution must ensure that other apps will still trigger alerts. What should you configure?. a detection rule. a suppression rule. an alert policy. an automated investigation.

Your company uses Microsoft Defender XDR. You need to use Microsoft Defender XDR deception rules to detect attacks as early as possible. What Microsoft Defender XDR service should you use to create the deception rules?. Microsoft Defender for Cloud Apps. Microsoft Defender for Endpoint. Microsoft Defender for Identity. Microsoft Defender for Office 365.

You have a Microsoft Sentinel workspace and a playbook named Playbook1. You need to ensure that you can manually run Playbook1 from an incident investigation. The solution must ensure that Playbook1 is available from Actions on the incident information window. What should you do?. Add the Microsoft Sentinel Automation Contributor role to Playbook1. Update Playbook1 to use a managed identity. Update Playbook1 to use the alert trigger. Update Playbook1 to use the incident trigger.

You have a Microsoft Sentinel workspace. You need to create a playbook that will run automatically in response to a Microsoft Sentinel incident. What should you create first?. a hunting query. a logic app. a trigger. an automation rule.

You have an Azure subscription that uses Microsoft Sentinel. You create a user named Admin1. You need to ensure that Admin1 can add playbooks in Microsoft Sentinel. The solution must follow the principle of least privilege. Which role should you assign to Admin1?. Logic App Contributor. Microsoft Sentinel Contributor. Microsoft Sentinel Responder. Owner.

You have an Azure subscription that contains a Microsoft Sentinel workspace. You have the following query. AzureActivity | summarize count() by OperationName, bin(TimeGenerated, 4h) You need to update the KQL query to show graphical output. Which operator should you use?. print. project. project-away. render.

You have a Microsoft Sentinel workspace that has a Microsoft Entra ID data connector. You need to create a report that visualizes sign-in information over time. What should you use?. a hunting query. a notebook. a playbook. a workbook.

You have a Microsoft Sentinel workspace named Workspace1. You need to create and customize a workbook based on an Identity & Access template in Workspace1. What should you do first?. Clone the workbook template. Edit the workbook template. Publish the workbook template. Save the workbook template.

You have a Microsoft Sentinel workspace. You need to view a visual representation of the data in the workspace. What should you use?. a notebook. a playbook. a workbook. Azure Data Factory.

Your on-premises network contains multiple devices that provide logs in Common Event Format (CEF). You have an Azure subscription and a Microsoft Sentinel workspace named Workspace1. You need to ingest the logs from the devices into Workspace1. What should you do first?. Add the Security Events via the AMA data connector in Microsoft Sentinel. Add the Syslog data connector in Microsoft Sentinel. Deploy a computer that runs Linux. Deploy a server that runs Windows Server.

You are implementing Microsoft Sentinel. You add a Microsoft Entra ID Protection data connector to Microsoft Sentinel. You need to verify whether data is ingested from the connector. Which table should you query?. AzureDiagnostics. CommonSecurityLog. SecurityAlert. SecurityEvents.

You have an Azure subscription that contains a Microsoft Sentinel workspace deployed to West US Azure region. You have the following Azure virtual machines: · A virtual machine named VM1 that runs Windows Server and is deployed to the East US Azure region · A virtual machine named VM2 that runs Windows Server and is deployed to the West US region · A virtual machine named VM3 that runs Windows 11 and is deployed to the East US region · A virtual machine named VM4 that runs Windows 11 and is deployed to the West US region You deploy Windows Security Events via the Azure Monitoring Agent (AMA) data connector to the Microsoft Sentinel workspace. From which virtual machines can you collect events?. VM1 and VM2 only. VM1, VM2, VM3 and VM4. VM2 and VM4. VM2 only.

Your company uses Microsoft Defender XDR. You have a hunting query that retrieves suspicious behaviors and returns values for DeviceId, IPAddress, and AccountName. You need to create a custom detection rule from the query that automatically applies full network isolation to any affected devices. The solution must minimize administrative effort. What should you do first in the Microsoft Defender portal?. From Advanced hunting, select Export. From Rules, configure the Advanced settings. From Rules, select Actions. From Settings, select the device group.

You have a Microsoft Sentinel workspace that has a Microsoft Defender for Cloud data connector. You create a Microsoft incident creation rule named Rule1. You need to ensure that Rule1 creates incidents based on Defender for Cloud alerts. What should you configure in Rule1?. a rule query. alert details. analytics rule logic. entity mapping.

You have a Microsoft Sentinel workspace. You create the following analytics rules in Microsoft Sentinel: · A near-real-time (NRT) rule named Rule1 · A fusion rule named Rule2 · A scheduled rule named Rule3 · A Microsoft security rule named Rule4 You need to identify which rules will generate incidents that can be investigated by using Microsoft Sentinel. Which rules should you identify?. Rule1 and Rule2 only. Rule1 and Rule3 only. Rule1, Rule2 and Rule3 only. Rule1, Rule2, Rule3 and Rule4. Rule4 only.

You have a Microsoft Sentinel workspace that contains active scheduled analytics rules and active near-real-time (NRT) analytics rules. You review MITRE ATT&CK coverage from Threat management in Microsoft Sentinel. For a specific MITRE technique, you need to identify: · The number of active detections in the workspace · The number of additional detections available but NOT configured What should you do in the MITRE ATT&CK coverage matrix?. Open SOC optimizations and review the spider charts. Enable View MITRE by threat scenarios and select a scenario. Select the technique in the matrix and review the technique details pane. Create a hunting query mapped to the technique and convert the query to a scheduled rule.

You have a Microsoft 365 E5 subscription. You plan to create a Microsoft Defender XDR hunting query to identify users that have been affected by clicking a suspicious URL. You need to create a detection rule that will mark the user as compromised. Which two properties should you include in the rule? Each answer presents part of the solution. AccountUpn. AlertId. ReportId. TimeGenerated.

You have a Microsoft 365 E5 subscription. You are using Microsoft Defender portal. You need to create a custom detection rule by using a hunting query. Which two columns should the query return? Each correct answer presents part of the solution. AlertId. ReportId. TimeGenerated. Timestamp.

You have a Microsoft Sentinel workspace that includes the following tables: · SigninLogs · AuditLogs · SecurityAlerts You need to create a query that will look for an IP address across the three tables and return the matching rows. Which operator should you use?. extend. join. lookup. union.

You have Microsoft Sentinel workspace that have The User and Entity Behavior Analytics (UEBA) behaviors layer enabled. You need to create an advanced hunting query that returns behavior titles and descriptions and the associated user UPNs by joining the behavior information dataset with the behavior entities dataset. Which table should you use as the behavior information source?. BehaviorEntities. BehaviorInfo. IdentityAccountInfo. IdentityInfo.

You have Microsoft Defender XDR deployed, and macOS devices are onboarded to Microsoft Defender for Endpoint. Tamper protection is enabled. You suspect that an attacker might be enabling troubleshooting mode to modify policy-locked settings. You need to identify devices that started troubleshooting mode during the last three hours by using advanced hunting. You are writing the following query. DeviceEvents | where Timestamp > ago(3h) | where [ Target1 ] | extend _tsmodeproperties = parse_json(AdditionalFields) | where _tsmodeproperties.TroubleshootingStateChangeReason contains "started" | summarize (Timestamp, ReportId)=arg_max(Timestamp, ReportId), count() by DeviceId | order by Timestamp desc Which expression should you insert at [Target1]?. ActionType == "AntivirusTroubleshootModeEvent". ActionType == "DeviceTamperProtectionDisabled". EventType == "TroubleshootingModeStarted". OperationName == "TroubleshootModeStart".

You use Microsoft Sentinel graph-based hunting in the Microsoft Defender portal. A scheduled analytics rule creates incidents from a third-party alert source. Some alerts identify the user only as user1, while other records identify the same account as user1@contoso.com. When analysts investigate activity in the hunting graph, two separate user nodes appear for the same person. You need to ensure that the alerts referencing user1 and user1@contoso.com are mapped to the same user entity in the hunting graph. What should you do?. Sync user account entities with Microsoft Entra ID. Enable incident creation rules for the scheduled analytics rule. Create an automation rule that renames the incident title to match the user UPN. Disable the Microsoft Defender XDR connector and enable the legacy Defender connectors.

You have an Azure subscription that contains a Microsoft Sentinel workspace. You develop three hunting queries. You need to ensure that the hunting queries run each time you open the Hunting blade. What should you do?. Add the queries as Bookmarks. Add the queries as Favorites. Add the queries to a livestream. Create an analytics rule.

You have a Microsoft Sentinel workspace that stores Azure Activity logs in a table named AzureActivity. You need to identify which users edited analytics rules in Microsoft Sentinel during the last 24 hours. You are writing the following KQL query. AzureActivity | where TimeGenerated > ago(1d) | where [Target1] | where ActivityStatusValue contains "Succeeded" | project Caller, TimeGenerated, Properties Which expression should you insert at [Target1]?. OperationName contains "Delete". OperationNameValue startswith "MICROSOFT.SECURITYINSIGHTS/ALERTRULES/WRITE". QueryText contains "MICROSOFT.SECURITYINSIGHTS/ALERTRULES/WRITE". ResourceProvider contains "SecurityInsights".

You have a Microsoft Sentinel workspace that ingests high-volume network session logs into a custom table named NetworkSessions_CL. A summary rule aggregates the raw sessions into a destination table named NetworkSessionSummary_CL. Analysts report that hunting queries time out when they query NetworkSessions_CL for trends across multiple days. You need to ensure that analysts can query seven days of network session logs without experiencing time outs. Which table should you instruct the analysts to query?. AzureActivity. NetworkSessions_CL. NetworkSessionSummary_CL. SecurityEvent.

You use Microsoft Visual Studio Code as an MCP client to run threat hunting queries from a Jupyter notebook connected to the Microsoft Sentinel MCP server. You have access to two Microsoft Sentinel data lake workspaces. MCP tool calls sometimes return results from different workspace identifiers. You need to ensure that the MCP tool calls always query a specific workspace in the data lake. What should you do?. Append Use 'default' as the workspaceId to the prompt. Add the x-mcp-client-tenant-id header to the MCP server definition. Remove and recreate the MCP server configuration in Visual Studio Code. Use the list_sentinel_workspaces tool to identify the workspace and specify that workspace ID in the prompt.

You have a Microsoft Sentinel workspace that ingests high-volume network and firewall logs into a custom Log Analytics table. Analysts frequently run hunting queries that aggregate the same data across several days. During peak ingestion, the queries time out. You need a solution that runs a scheduled KQL aggregation in the background and stores the results in a smaller analytics-tier table that analysts can query during investigations. Which Microsoft Sentinel feature should you use?. KQL jobs. scheduled analytics rules. search jobs. summary rules.

You have a Microsoft 365 E5 subscription that contains five Microsoft SharePoint Online sites. You apply data loss prevention (DLP) policies to the SharePoint Online sites. You need to review the DLP alerts. Which two portals can you use? Each correct answer presents a complete solution. the Microsoft Purview portal. the SharePoint admin center. the Microsoft 365 admin center. the Microsoft Defender portal.

You have a Microsoft 365 E5 subscription that contains a user named User1 and a Microsoft SharePoint Online site named Site1. User1 leaves the company, and the user’s account is deleted. You need to identify whether User1 downloaded files from Site1 during the 30 days before the account was deleted. Which type of policy should you create?. a Microsoft Defender for Cloud Apps file policy. a Microsoft Defender for Office 365 alert policy. a Microsoft Purview insider risk management policy. a Microsoft Entra Governance access review.

You have a hybrid Microsoft Entra tenant and a Microsoft 365 E5 subscription. You need to review all changes made to the Active Directory Enterprise Admins group during the last 14 days. What should you use?. the Microsoft Entra ID Provisioning Analysis workbook. the Microsoft Entra ID Sensitive Operations Report workbook. the Microsoft Defender for Cloud Apps Cloud Discovery users page. the Microsoft Defender for Identity Modifications to sensitive groups report.

You have a hybrid Microsoft Entra tenant and a Microsoft 365 E5 subscription. You need to identify any high-risk users that have performed a password reset during the last 14 days. What should you use?. the Identity Protection risk analysis workbook in Microsoft Entra ID. the Sensitive Operations Report workbook in Microsoft Entra ID. the Risky sign-ins report in Microsoft Entra ID Protection. the Risky users report in Microsoft Entra ID Protection.

You have a Microsoft Defender XDR deployment that includes Microsoft Defender for Endpoint, Microsoft Defender for Identity, and Microsoft Defender for Cloud Apps. You need to view alerts from all three security services aggregated as a single incident. Which page should you use in the Microsoft Defender portal?. Device inventory. Hunting. Incidents & alerts. Secure Score.

You have Microsoft Defender for Cloud workload protections enabled for an Azure Kubernetes Service (AKS) cluster. Alerts are investigated in the Microsoft Defender portal. For a container, you have a Defender for Cloud alert that includes manual remediation steps. The same type of alert occurs frequently for new containers in the cluster. You need to ensure that the remediation steps run automatically when the alert occurs. What should you create?. a custom detection rule. a filter. an incident tag. a logic app.

You have a hybrid identity environment that contains: · On-premises Active Directory domain controllers monitored by using Microsoft Defender for Identity · Microsoft Entra ID Protection enabled for cloud identity risk detection · Incidents managed in Microsoft Defender XDR An incident in the Microsoft Defender portal includes identity-related alerts for a user named user1@contoso.com. You confirm that the account is compromised, and the user appears as a Risky user in Microsoft Entra ID Protection. You need to remediate the identity risk and ensure that the user completes strong authentication again before regaining access to Microsoft 365 resources. What should you do?. Create a Conditional Access policy. Dismiss the user risk in Microsoft Entra ID Protection. Reset the user multifactor authentication (MFA) registration. Install Defender for Identity sensors on all the domain controllers.

You investigate incidents in the Microsoft Defender portal by using the embedded Microsoft Security Copilot experience. During a phishing investigation, analysts do NOT see Copilot-generated incident summaries or guided responses. Copilot features are unavailable for incident investigation in Microsoft Defender XDR, although analysts can use the standalone Security Copilot experience. You need to enable Security Copilot to ensure that it can invoke Microsoft Defender XDR product capabilities from the embedded experience. What should you do?. Enable the Microsoft Defender XDR plugin in Security Copilot. Create a Microsoft Sentinel automation rule to tag and close incidents. Connect a Microsoft Sentinel workspace to the Microsoft Defender portal. Enable automatic investigation and response (AIR) for Microsoft 365 and Microsoft Entra ID alerts.

Your company uses Microsoft Defender for Endpoint. A device is flagged when one of its processes communicates with a known command-and-control server. You need to remotely analyze the suspicious process to identify whether it is malicious. What should you use in the Microsoft Defender portal?. Advanced hunting. Live response. Threat analytics. Action center.

Your company uses Microsoft Defender for Endpoint. You discover that a device was used to download and run malware. You need to identify the user who signed in interactively to the device during the time of the attack. What should you use in the Microsoft Defender portal?. the IdentityInfo table. the Incidents queue. the timeline. Threat analytics.

Your company uses Microsoft Defender for Endpoint. All security alerts are automatically remediated. Microsoft Defender notifies you that it blocked a malware infection attempt on a device. You need to perform an analysis on the device. The solution must meet the following requirements: Analyze the device memory, active processes, and inbound and outbound network connections. Minimize the impact of the analysis on device users. Avoid identifying false positives as malicious. What should you do first?. Collect an investigation package. Isolate the device. Request an antivirus scan. Review the alert evidence.

Your company uses Microsoft Defender for Endpoint. You discover an incident related to a device named Device1. You need to review the most recent actions taken on Device1. The solution must minimize administrative effort. What should you use in the Microsoft Defender portal?. Advanced hunting. the Alerts queue. the Incidents queue. the Timeline.

Your company uses Microsoft Defender for Endpoint. A security incident is currently affecting devices that run Windows 11 or macOS. You need to identify the scope of the incident. What should you use in the Microsoft Defender portal?. Advanced hunting. Action center. Deep analysis. Device inventory.

You have Windows 11 devices onboarded to Microsoft Defender for Endpoint. An incident contains an alert for a suspicious PowerShell command line on a device. You need to use the device Timeline to create a clean breach timeline that meets the following requirements: · Highlights key device events · Displays only the highlighted events · Limits the view to events that occurred before the highlighted event What should you do?. Select the suspicious event and select Hunt for related events. Export the timeline of a custom date range and review the exported file. Review the Active alerts card on the device Overview tab and analyze the alert drilldown. Flag the key event or events, enable the Only Flagged events filter, and use the time bar to show events before the flagged event.

You have a Microsoft Sentinel workspace. You need to prevent a built-in Advanced Security Information Model (ASIM) parser from being updated automatically. Which two actions can you perform? Each answer presents a complete solution. Build a custom unifying parser and include the built-in parser version. Create a hunting query and reference the built-in parser. Create an analytics rule and include the built-in parser. Redeploy the built-in parser and specify a CallerContext value of Any and a SourceSpecificParser value of Any. Redeploy the built-in parser and specify a CallerContext value of Built-in.

You send Microsoft Graph activity logs to a Log Analytics workspace. During the last three days, some requests to the /groups resource returned HTTP 401 and HTTP 403 errors. You need to identify the top 20 calling entities that generate the highest number of distinct failed requests to /groups. Which KQL query should you run?. MicrosoftGraphActivityLogs | where TimeGenerated >= ago(30d) | where RequestUri contains "/groups" | summarize UniqueRequests=dcount(RequestId) by UserPrincipalName | sort by UniqueRequests desc | limit 20. MicrosoftGraphActivityLogs | where TimeGenerated >= ago(3d) | where ResponseStatusCode == 401 and ResponseStatusCode == 403 | where RequestUri contains "/groups" | summarize UniqueRequests=count() by AppId | sort by UniqueRequests desc | limit 20. MicrosoftGraphActivityLogs | where TimeGenerated >= ago(3d) | where ResponseStatusCode == 401 or ResponseStatusCode == 403 | where RequestUri contains "/groups" | summarize UniqueRequests=count_distinct(RequestId) by AppId, ServicePrincipalId, UserId | sort by UniqueRequests desc | limit 20. SigninLogs | where TimeGenerated >= ago(3d) | where ResultType in ("401","403") | where ResourceDisplayName contains "groups" | summarize UniqueRequests=dcount(CorrelationId) by AppId, UserId | sort by UniqueRequests desc | limit 20.

You have a Microsoft 365 tenant that uses Microsoft Purview Audit (Standard). An audit search in the Microsoft Purview portal returns more than 80,000 matching events. Your SIEM team requires a CSV export that includes all matching audit records. You cannot upgrade to Audit (Premium). You need to ensure that no audit records are omitted due to export limits. What should you do?. Export the audit search results directly from the Microsoft Purview portal. Create a new Audit (Premium) audit log retention policy and rerun the search. Duplicate the search job by using Copy this search and export the results from each copy. Refine the search into multiple smaller time ranges and export each result set to a CSV file.

You have a Microsoft 365 tenant that uses Microsoft Purview Audit (Standard). Your security team investigates activity by using the audit search tool in the Microsoft Purview portal. An investigation requests Microsoft Entra ID and Exchange Online audit events from nine months ago, but no results are returned. You need to ensure that, going forward, audit records for Microsoft Entra ID and Exchange Online remain searchable for at least one year. Which Microsoft Purview auditing solution should you use?. Audit (Premium). Audit (Standard). Office 365 Management Activity API. Search-UnifiedAuditLog in Exchange Online PowerShell.

You have a Microsoft 365 E5 subscription that uses Microsoft SharePoint Online. You need to be notified if a user downloaded a large number of documents from SharePoint Online during the month before the user’s account was deleted. What should you use?. a Microsoft Defender for Cloud Apps file policy. a Microsoft Defender for Office 365 alert policy. a Microsoft Purview insider risk management policy. a Microsoft Entra Governance access review.

You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Cloud. You have a lab environment that uses an IP address range of 14.38.2.0/24. You receive multiple alerts from the lab environment. You need to remove all alerts that originate from the lab environment network. The solution must meet the following requirements: · Automatically close all future alerts from the lab environment. · Minimize administrative effort. What should you create?. a firewall policy. a logic app. a suppression rule. an automation rule.

You have Microsoft Defender XDR and Microsoft Purview Insider Risk Management deployed. Analysts can see incidents from Defender for Endpoint and Defender for Identity in the Microsoft Defender portal. However, Insider Risk Management alerts are NOT visible. You need to ensure that Insider Risk Management alerts appear as incidents in the Microsoft Defender portal and are filterable by Service source. What should you do first?. Filter the Microsoft Defender XDR incident queue by Service source. Create a custom detection rule in Microsoft Defender XDR Advanced hunting. Approve pending remediation actions in the Microsoft Defender XDR Action center. Enable Share user risk details with other security solutions in the Microsoft Purview portal.

You have Windows 11 devices onboarded to Microsoft Defender for Endpoint. Analysts investigate incidents in the Microsoft Defender portal. An incident contains an alert for a suspicious PowerShell command line. On the evidence tab, the incident lists several files and processes. One file has NOT been observed previously in your organization. You need to analyze the unfamiliar file from within Defender for Endpoint and ensure that the result can support future detections. What should you do from the file’s details page?. Add the file hash as an incident entity in Microsoft Sentinel. Review the device Timeline tab to examine chronological events. Submit the file for deep analysis and add the file as an indicator. Review the device Overview tab for the device risk level and exposure level.

You use Microsoft Purview Audit. You discover that an external user accessed a Microsoft SharePoint Online document that contains confidential information. You need to identify the name of the user that accessed the document and what the user did. What should you do first?. From Microsoft Sentinel, run an Advanced Security Information Model (ASIM) query. From PowerShell, run Get-SimpleAuditLogReport. From the Microsoft Purview portal, run a content search. From the Microsoft Purview portal, run an audit log search.

You have a Microsoft 365 subscription that contains a user named User1. You need to identify whether User1 signed in to Microsoft 365 and shared a document stored in Microsoft OneDrive during the last 30 days. What should you use?. the Azure portal. the Microsoft Defender portal. the Microsoft Entra admin center. the Microsoft Purview portal.

You use Microsoft Purview eDiscovery to investigate potential data leaks across Microsoft Exchange Online mailboxes and SharePoint Online sites. You create an eDiscovery search that targets multiple custodians and SharePoint locations. The search uses several wildcard-heavy keywords to identify potentially leaked credentials. When you run the search, it fails and returns a CS007 error. You need to successfully run the investigation search, while keeping the result set manageable for the service to process. What should you do?. Reindex the affected SharePoint and OneDrive locations before rerunning the search. Remove duplicate or conflicting mailbox objects by using Get-Recipient and rerun the search. Wait for directory synchronization to complete and verify the recipients by using Get-Recipient. Split the search into smaller searches by limiting locations or date ranges, and then retry the search.

You send Microsoft Graph activity logs to a Log Analytics workspace. A Microsoft Entra sign-in log entry for a user named user1@contoso.com shows a suspicious interactive sign-in that includes a unique token identifier (UTI) of 8c1b2a2e-6b5f-4a5d-9b3b-2aa5c0e9f4aa. You need to identify which Microsoft Graph API requests were made by the same access token during the last 24 hours. Which Microsoft Graph activity log attribute should you filter on?. ClientRequestId. OperationId. SessionId. SignInActivityId.

You have a Microsoft 365 subscription that sends Microsoft Graph activity logs to a Log Analytics workspace. You need to identify the top 20 identities that generate the highest number of failed authorization requests to the /groups endpoint during the last three days. Failures are defined as HTTP 401 or HTTP 403 errors. You are writing the following KQL query. MicrosoftGraphActivityLogs | where TimeGenerated >= ago(3d) | where RequestUri contains "/groups" | where [ Target1 ] | summarize UniqueRequests = count_distinct(RequestId) by AppId, ServicePrincipalId, UserId | sort by UniqueRequests desc | limit 20 Which expression should you insert at [Target1]?. ResponseStatusCode == 401 or ResponseStatusCode == 403. ResponseStatusCode == 429. ResponseStatusCode >= 500. ResultType in ("401","403").

Your company uses Microsoft Defender XDR. All Windows 11 devices are onboarded to Microsoft Defender for Endpoint. You discover that some devices fail to report alerts. The devices are available in the Microsoft Defender portal. You need to ensure that all the devices report alerts. The solution must minimize administrative effort. What should you do in the Microsoft Defender portal?. From the Alerts blade, filter the alerts. From the Alerts blade, modify the Alert service settings. From the Configuration management page, approve the devices. From the Device inventory blade, modify the group membership.

You have a Microsoft 365 E5 subscription and an Azure subscription. You use Microsoft Sentinel with the following data connectors: · Microsoft Entra ID · Microsoft Entra ID Protection · Microsoft 365 · Microsoft Defender for Office 365 From Microsoft Sentinel, you create an automation rule named Rule1. You need to configure an Incident provider condition for Rule1. Which two incident providers can you specify in the condition? Each correct answer presents a complete solution. Microsoft Entra ID. Microsoft Sentinel. Microsoft Defender for Office 365. Microsoft 365.

You have a Security Operations Center (SOC) and a Microsoft Sentinel workspace. You need to ensure that Tier 1 SOC analysts can manage incidents in Microsoft Sentinel by running preconfigured playbooks. The solution must follow the principle of least privilege. Which two roles should you assign to the analysts? Each correct answer presents part of the solution. Microsoft Sentinel Playbook Operator. Microsoft Sentinel Contributor. Microsoft Sentinel Reader. Microsoft Sentinel Responder. Security Administrator.

You have an Azure subscription that contains a Microsoft Sentinel workspace and a resource group named RG1. The workspace is deployed to RG1. The subscription is linked to a Microsoft Entra tenant that contains four users named User1, User2, User3, and User4. The users are assigned the following roles for RG1: · User1 is assigned the Owner role. · User2 is assigned the Microsoft Sentinel Responder role. · User3 is assigned the Microsoft Sentinel Contributor role. · User4 is assigned the Microsoft Sentinel Reader and Workbook Contributor roles. You need to delegate the addition of workbooks to the workspace. Which user can add the workbook?. User1 and User4 only. User1 only. User1, User2, User3 and User4. User1, User3 and User4 only.

You have a Security Operations Center (SOC) and a Microsoft Sentinel workspace. You plan to provide the SOC manager with a Microsoft Sentinel workbook that includes the following metrics: · Incident created over time · Mean time to triage You need to create the workbook by using a template. The solution must minimize administrative effort. Which template should you use?. Analytics Efficieny. Incident Overview. Investigation Insights. Security operations efficiency.

You have an Azure subscription and a Microsoft SharePoint Online site named Site1. You are implementing Microsoft Sentinel. You need to collect events from Site1. Which data connector should you add to Microsoft Sentinel?. Microsoft Defender for Office 365. Microsoft 365. Security Events via AMA. Syslog.

You have a Microsoft Sentinel workspace. You need to enable User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel. Which two data sources support the use of UEBA? Each correct answer presents a complete solution. Azure Activity. Azure SQL Databases. Microsoft 365. Security Events. Threat Intelligence Platforms.

You have a Microsoft Sentinel playbook named Playbook1. Playbook1 is triggered when a new Microsoft Sentinel incident is created. You create a custom near-real-time (NRT) analytics rule named NRTRule1. You need to ensure that NRTRule1 can use Playbook1. What should you do?. Add an automation rule to NRTRule1. Configure Alert Automation (Classic) on NRTRule1. Configure the Incident settings for NRTRule1. Recreate NRTRule1 as a scheduled query rule.

You have a Microsoft Sentinel workspace. You need to create an analytics rule that will use entity mapping. Which type of rule should you create?. anomaly. fusion. machine learning (ML) behavioral analytics. scheduled.

You have a Microsoft Sentinel workspace that contains the following rules: · A near-real-time (NRT) rule named Rule1 · A fusion rule named Rule2 · A scheduled rule named Rule3 · A machine learning (ML) behavior analytics rule named Rule4 You need to review the query logic used for individual rules. Which rules can you review?. Rule1 and Rule3 only. Rule1, Rule2 and Rule3 only. Rule1, Rule2, Rule3 and Rule4. Rule2 and Rule3 only. Rule3 only.

Your company uses Microsoft Defender XDR. During an investigation, you discover that a user ran the following query to hunt for suspicious processes. DeviceProcessEvents | where InitiatingProcessFileName =~ "powershell.exe" | project Timestamp, FileName, InitiatingProcessFileName | order by Timestamp desc | limit 2 You need to review the results of the query and identify whether it returned the intended data. What should you use?. Cloud Shell in the Azure portal. Advanced Hunting in the Microsoft Defender portal. the Microsoft Graph Security API. Microsoft Sentinel in the Microsoft Defender portal.

You have a Microsoft 365 E5 subscription that contains three devices named Device1, Device2, and Device3. The subscription uses Microsoft Defender for Endpoint. You are performing an investigation by using the following query. DeviceLogonEvents | where ActionType == "LogonFailed" | summarize LogonFailures=count() by DeviceName, LogonType, InitiatingProcessCommandLine | where LogonFailures > 3 | project LogonFailures, DeviceName, LogonType, InitiatingProcessCommandLine | sort by LogonFailures desc You need to exclude Device3 from the query. Which statement should you add to the query?. | where DeviceName != "Device3". | where DeviceName == "Device3". | where DeviceName =~ "Device3". | where DeviceName has "Device3".

You investigate an incident in the Microsoft Defender portal. The incident graph includes a device and a user account. Your team wants to analyze potential attack propagation from the compromised device by using Blast radius analysis. When you select the device node in the incident graph, the View blast radius option is unavailable. You need to make Blast radius analysis available in the investigation view. What should you do?. Configure Microsoft Sentinel to use a data lake. Run a go hunt query for the device entity from the incident graph. Enable Microsoft Sentinel User and Entity Behavior Analytics (UEBA). Create a custom detection rule that runs in Continuous (NRT) frequency.

You use a Microsoft Sentinel data lake. A scheduled KQL job named Daily-App-Audit-Baseline runs daily and appends results to an existing analytics-tier table named AppAuditActivityBaseline. The job fails and returns the following error. “The query output schema does not match the schema of the destination table.” You discover that the query was modified to rename an output column and add a new column. You need to ensure that Daily-App-Audit-Baseline runs successfully and continues writing to the existing AppAuditActivityBaseline table. What should you do?. Disable and reenable the job. Change the job to create a new destination table. Run the query interactively in Data lake exploration instead of using a KQL job. Modify the query so that its output column names and data types match the AppAuditActivityBaseline table schema.

You have a Microsoft Sentinel workspace that stores Azure Activity logs in a table named AzureActivity. Earlier today, an analytics rule that has the following rule resource ID was modified. alertRules/11111111-1111-1111-1111-111111111111 You need to identify which users made the change and when. You are writing the following KQL query. AzureActivity | where OperationNameValue startswith "MICROSOFT.SECURITYINSIGHTS/ALERTRULES/WRITE" | where Properties contains "alertRules/11111111-1111-1111-1111-111111111111" | where [ Target1 ] | project Caller, TimeGenerated Which expression should you insert at [ Target1 ]?. ActivityStatusValue contains "Succeeded". OperationName contains "Delete". QueryText contains "alertRules/11111111-1111-1111-1111-111111111111". ResourceProvider contains "SecurityInsights".

You have a Microsoft Sentinel workspace that ingests high-volume firewall logs into a custom table named FirewallLogs_CL. Analysts ran interactive KQL queries that aggregated logs by source IP and destination port during the last 24 hours. During peak ingestion, the queries timed out. You need to reduce query time by running scheduled aggregations and storing the summarized results in a custom Log Analytics table for later queries. Which Microsoft Sentinel feature should you use?. a scheduled analytics rule. a summary rule that writes results to a destination table. a search job that hydrates data from FirewallLogs_CL into a new custom table. a KQL job that runs scheduled asynchronous queries in the Microsoft Sentinel data lake.

You have a Microsoft 365 E5 subscription that contains the following devices: · Device1 – Laptop, Windows 11 Enterprise · Device2 – Laptop, Windows 11 Pro · Device3 – Mobile, Android · Device4 – Laptop, macOS All the devices are onboarded to the Microsoft Defender. You plan to create the following advanced hunting query. DeviceEvents | where ActionType contains 'Remote' | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountUpn, ActionType You need to identify which devices will be returned by the query. What should you identify?. Device1 only. Device1 and Device2 only. Device1, Device2, and Device4 only. Device1, Device2, Device3, and Device4.

You have a Microsoft 365 E5 subscription. You are implementing Microsoft Defender for Endpoint. You need to ensure that you can block specific IP addresses and URLs. Which advanced feature should you configure?. Custom network indicators. Enable EDR in block mode. Restrict correlation to within scoped device groups. Web content filtering.

Your company has the following devices: · A Windows 11 device named Device1 · An iOS device named Device2 · An Android device named Device3 Which devices can be onboarded and protected by using Microsoft Defender for Endpoint?. Device1 only. Device1 and Device2 only. Device1 and Device3 only. Device1, Device2, and Device3.

You have a Microsoft Sentinel workspace. You plan to add a workbook to Microsoft Sentinel. You create a workbook query. You need to display the query results in a time chart. Which keyword should you include in the query?. extend. print. project. render. summarize.

You have a Microsoft Sentinel workspace. Your environment contains the following virtual machines that run Windows Server: · 150 Azure virtual machines · 50 on-premises virtual machines You plan to use the Windows Security Events via AMA data connector to collect events from the virtual machines. The 50 on-premises machines do NOT appear in the resource picker when you creating a data collection rule (DCR). You need to ensure that the on-premises virtual machines can be selected in the DCR. What should you do on the on-premises virtual machines?. Install the Azure File Sync agent. Install the Azure Connected Machine agent. Create the DCR rule in the same subscription as the workspace. Configure Windows Event Forwarding and use the Windows Forwarding Events data connector.

You have a Microsoft Sentinel workspace named SecOps-WS. You have a datacenter that contains a manufacturing application. The application writes JSON audit records that contain the following fields: · EventTime · User · Action · AssetId · Result The application will send the records to Azure by using the Azure Monitor Logs Ingestion API and will reference a data collection rule (DCR). The log format does NOT match any existing Microsoft Sentinel tables. You plan to ingest the records into SecOps-WS and enable analysts to query the data by using KQL. You need to ensure that the destination table uses custom column names and data types. What should you create first?. a custom log table in a Log Analytics workspace. a data connector that sends logs to the AzureDiagnostics table. a DCR that collects custom text logs by using the Azure Monitor Agent. a workspace transformation DCR that outputs data to the CommonSecurityLog table.

You have a Microsoft Sentinel workspace that ingests Microsoft Defender XDR incidents and Azure Activity logs. Your company has the required premium license for Microsoft's curated threat intelligence. You need to ingest Microsoft-curated threat indicators into the workspace by using a built-in connector and confirm that ingestion is enabled. The solution must minimize configuration effort. What should you do?. Use the Threat Intelligence Upload API to send STIX objects to the workspace. Configure the Threat Intelligence – TAXII connector and provide a TAXII server API root and collection ID. Install the Threat Intelligence solution, and then enable and connect the Premium Defender Threat Intelligence connector. Enable the Threat Intelligence Platforms connector and configure ingestion by using the Microsoft Graph Security indicators API.

Your company uses Microsoft Defender XDR. You need to create a custom detection rule that will remediate malicious activity when an alert is detected. The solution must minimize administrative effort. What should you configure?. The actions. the Alert suppression settings. the incident queue. the severity.

You have a Microsoft Sentinel workspace that ingests Microsoft Entra ID sign-in logs and firewall logs. A scheduled analytics rule detects suspicious sign-ins and maps the Account and IP entities. You need to reduce the time between a suspicious sign-in and alert creation. The solution must meet the following requirements: · Run automatically every minute. · Use a one-minute lookback period. · Use ingestion time to account for ingestion delay. Which type of analytics rule should you create?. a scheduled analytics rule. a Microsoft security analytics rule. a near-real-time (NRT) analytics rule. a machine learning (ML) behavior analytics rule.

You use advanced hunting in Microsoft Defender XDR to create custom detections. You write a KQL query that aggregates events by DeviceId and filters based on the aggregated count. When you create a custom detection rule from the query, validation fails because the query fails to return the required columns. You need to modify the query so that it continues to use aggregation and returns the columns required for a custom detection rule. Which KQL approach should you use?. Replace the aggregation with distinct DeviceId. Set the custom detection rule frequency to Every 24 hours. Add project Timestamp, DeviceId, ReportId after the summarize operator. Use summarize (Timestamp, ReportId)=arg_max(Timestamp, ReportId), count() by DeviceId, and then filter on the count.

Your company uses Microsoft Defender for Endpoint. You investigate a security incident and discover devices that contain malicious files. You need to perform an analysis of the files. The solution must minimize the possibility of the files infecting other devices. What should you use to submit the files to Microsoft in the Microsoft Defender portal?. Collect an investigation package. Create a custom detection rule. Report to Microsoft as false positive. Submit for deep analysis.

You are using Microsoft Defender for Endpoint. An alert for a suspicious PowerShell command line is associated with a device named WS-23. You need to view a chronological list of events on WS-23 for a custom time range to correlate activity related to the alert. What should you use?. Advanced hunting. the Alerts tab. an investigation package. the Timeline tab.

You have Windows 11 devices onboarded to Microsoft Defender for Endpoint. An incident in Microsoft Defender XDR includes an alert for a suspicious PowerShell command line on a device named Device1. You need to get a snapshot of the current state of Device1 from the device page in the Microsoft Defender portal. You must collect the data from the portal without initiating a Live Response session. What should you do?. Export the inventory of Device1. Select Collect investigation package and confirm the action. Run mpcmdrun.exe -GetFiles from an elevated Command Prompt on Device1. Turn on troubleshooting mode and wait for the device timeline to update.

You have a Microsoft 365 E5 subscription that contains the following users: · Admin1: Assigned the Global Administrator role. · Admin2: Assigned the Security Administrator role. · Admin3: Assigned the Exchange Administrator role. You need to identify which users can search audit logs by using the Microsoft Purview portal. What should you identify?. Admin1 only. Admin1 and Admin2 only. Admin1 and Admin3 only. Admin1, Admin2 and Admin3.